Malware Persistence
57 items from karneades/awesome-malware-persistence ★313
-
KnockKnock objective-see.com
See what's persistently installed on your Mac.
-
Dylib Hijack Scanner objective-see.com
Utility for scanning apps vulnerable to dylib hijacking.
-
Database Triggers as Persistence Mechanisms trustwave.com
An in-depth write up about database triggers providing persistence.
-
theevilbit's series "Beyond the good ol' LaunchAgents" theevilbit.github.io
List of macOS persistence beyond just the LaunchDaemons or LaunchAgents.
-
Autoruns technet.microsoft.com
A powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a live system and in limited ways from offline images. There is a UI and a command line program and the output format can be set to CSV which can…
-
Hunting for persistence via Microsoft Exchange Server or Outlook speakerdeck.com
Blog post about Microsoft Exchange server persistence.
-
How malware persists on macOS sentinelone.com
List of macOS persistence mechanisms.
-
MoonBounce: the dark side of UEFI firmware securelist.com
An in-depth write up about one particular UEFI bootkit.
-
Linux Malware Persistence with Cron sandflysecurity.com
Blog post about Linux persistence using cron jobs.
-
Linux LKM Persistence righteousit.com
Rootkit leveraging Linux loadable kernel module (LKM).
-
Common malware persistence mechanisms resources.infosecinstitute.com
Different persistence mechanisms for different vectors are described.
-
Linux Persistence Techniques research.splunk.com
List of persistence techniques.
-
Persistence – COM Hijacking, 2020 pentestlab.blog
-
osquery osquery.readthedocs.io
Query persistence mechanisms on clients.
-
Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exe oddvar.moe
Blog post about abusing GlobalFlag for process execution.
-
Shadow Linking: The Persistence Vector of SaaS Identity Threat obsidiansecurity.com
Abuse of additional identity providers to persist in an environment.
-
Removing Backdoors – Powershell Empire Edition n00py.io
Various blog posts handle the removal of WMI implants.
-
Detecting & Removing an Attacker's WMI Persistence medium.com
Blog post about detecting and removing WMI persistence.
-
Linux Red Team Persistence Techniques linode.com
List of persistence techniques.
-
KAPE kroll.com
The tool allows collecting various predefined artifactgs using targets and modules, see KapeFiles which include persistence mechanisms, among others there's a collection of LNK files, scheduled task files and scheduled task listing or a WMI repository auditing module.
-
Hexacorn's blog hexacorn.com
Blog series "Beyond good ol' Run key" covering a lot of Windows persistence mechanisms.
-
Windows Persistence using WinLogon hackingarticles.in
Blog post about abusing WinLogon.
-
AutorunsToWinEventLog.ps1 github.com
Instead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding.
-
PowerShell implementation of Autoruns github.com
Another way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!
-
KnockKnock github.com
A persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the plugins folder, e.g. LaunchItems or StartupScripts.
-
Sigma rules github.com
Repository of detection rules, covering persistence techniques as well. You can even use filters such as --filter tag=attack.persistence or specifically for one technique tag=attack.t1084.
-
PoisonApple github.com
Learn about various macOS persistence techniques by looking at the source code of PoisonApple.
-
PANIX - Persistence Against *NIX - Features github.com
List of persistence techniques.
-
COM Object hijacking: the discreet way of persistence, 2014 gdatasoftware.com
-
- next page of items loading…
